CVE-2025-22535 Overview
CVE-2025-22535 is a SQL injection vulnerability in the WPListCal WordPress plugin developed by jonkern. The flaw affects all versions of wplistcal up to and including 1.3.5. It stems from improper neutralization of special elements used in an SQL command [CWE-89], allowing authenticated attackers to inject arbitrary SQL statements into database queries. The vulnerability carries a network attack vector and requires only low privileges to exploit. Successful exploitation exposes sensitive data stored in the WordPress database and can affect availability of the underlying site.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user data, credentials, and site configuration.
Affected Products
- jonkern WPListCal plugin for WordPress
- All versions from n/a through 1.3.5
- WordPress sites with the wplistcal plugin installed and activated
Discovery Timeline
- 2025-01-09 - CVE-2025-22535 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22535
Vulnerability Analysis
The WPListCal plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries executed against the WordPress database. This maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command. The scope is marked as changed, meaning exploitation can affect resources beyond the vulnerable component. An attacker with low-privileged access, such as a subscriber-level WordPress account, can craft SQL payloads that alter query logic. The impact profile shows high confidentiality loss and low availability loss, with no direct integrity impact reported. The EPSS score sits at 0.362% with a percentile of 28.058, indicating limited observed exploit interest at this time.
Root Cause
The plugin concatenates untrusted request parameters directly into SQL statements without using prepared statements or the WordPress $wpdb->prepare() API. Special characters such as single quotes, comments, and UNION keywords pass through unfiltered, allowing attackers to break out of the intended query context and append malicious clauses.
Attack Vector
Exploitation occurs over the network against the WordPress site. An authenticated user submits crafted input to a vulnerable plugin endpoint. The plugin passes the input into a SQL query, executing the attacker-controlled statement. Attackers typically use UNION-based or blind Boolean techniques to extract data from the wp_users table, including password hashes and session tokens. Refer to the Patchstack WordPress Vulnerability advisory for advisory details.
Detection Methods for CVE-2025-22535
Indicators of Compromise
- HTTP requests to wplistcal plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
- Unexpected read operations against the wp_users or wp_options tables originating from the WordPress PHP worker
- Web server access logs showing repeated parameter tampering from a single authenticated session
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that flag SQL injection payloads targeting WordPress plugin query parameters
- Enable MySQL general or audit logging and alert on queries containing tautologies, UNION operators, or information_schema references
- Correlate authenticated WordPress sessions with anomalous database query patterns to surface abuse of low-privilege accounts
Monitoring Recommendations
- Track plugin inventory and version data across WordPress deployments to identify hosts running wplistcal at or below version 1.3.5
- Monitor outbound data volume from WordPress hosts for signs of bulk table exfiltration
- Review WordPress user role changes and new administrator creation events following suspicious plugin activity
How to Mitigate CVE-2025-22535
Immediate Actions Required
- Deactivate and remove the WPListCal plugin from any WordPress site running version 1.3.5 or earlier until a patched release is confirmed
- Rotate all WordPress user passwords and invalidate active sessions if exploitation is suspected
- Audit database contents for unauthorized modifications, injected administrator accounts, or exfiltrated user records
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Consult the Patchstack advisory for wplistcal for the latest patch status and vendor guidance.
Workarounds
- Restrict access to WordPress authenticated endpoints using IP allowlisting or reverse proxy authentication until the plugin is patched or removed
- Enforce a WAF ruleset that blocks SQL injection signatures on all /wp-admin/ and /wp-content/plugins/wplistcal/ request paths
- Apply least-privilege database credentials for the WordPress site so the runtime account cannot read sensitive tables or perform schema changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
